solidity-compile-deploy@1.0.0

Analysis

solidity-compile-deploy@1.0.0 exfiltrates all environment variables to a remote Redis database when imported. The index.js module creates a connection to clean-calf-70292[.]upstash[.]io:6379 (an Upstash Redis instance) using an embedded connection URL, then serialises the entire process.env object to the key "foo" on that server. This steals any credentials, tokens, API keys and secrets present in the runtime environment (NPM_TOKEN, GITHUB_TOKEN, AWS keys, etc.). The exfiltration executes as a side-effect of loading the module with no lifecycle hook required.